harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

change the signed token format. We don't folks to be able to submit random text for signing by us, as they could then use these to generate known signatures.

Browse Source
This commit is contained in:
redmatrix
2016-05-22 22:44:13 -07:00
parent a1aa3d9061
commit bbc71343bd
3 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Zotlabs/Zot/Finger.php
View File

@@ -110,7 +110,7 @@ class Finger {
if($x) {
$signed_token = ((is_array($x) && array_key_exists('signed_token',$x)) ? $x['signed_token'] : null);
if($signed_token) {
$valid = rsa_verify(self::$token,base64url_decode($signed_token),$x['key']);
$valid = rsa_verify('token.' . self::$token,base64url_decode($signed_token),$x['key']);
if(! $valid) {
logger('invalid signed token: ' . $url . $rhs, LOGGER_NORMAL, LOG_WARN);
return $ret;